The present invention relates to security on computers, and more specifically, a method to train a model for an anomalous behavior monitor for individual users. More specifically, the present invention teaches an adaptation of the Local Outlier Factor (LOF) algorithm to select benign samples from the target user's own data points and to select anomalous samples from other system users' data points so that, both anomalous and benign samples can be obtained for training an anomaly detection model for the target user.